I have an on-premise exchange 2016 environment.
There is an internal exchange server (on the domain) and a server in the DMZ that is not on the domain that is running the Edge Transport service.
When I run the tls check with checktls.com, I get this as the error:
SSLVersion in use: TLSv1_2 Cipher in use: ECDHE-RSA-AES256-SHA384 Certificate 1 of 1 in chain: Cert VALIDATION ERROR(S): unable to get local issuer certificate; unable to verify the first certificate This may help: What Is An Intermediate Certificate So email is encrypted but the recipient domain is not verified Cert Hostname DOES NOT VERIFY (mail.company.co != COMPANYDMZ | DNS:COMPANYDMZ | DNS:COMPANYDMZ.dmz.local) So email is encrypted but the host is not verified cert not revoked by CRL cert not revoked by OCSP serialNumber=11:22:33:b1:a3:4f:7a:95:4c:7a:54:c3:70:be:ec:00 subject= /CN=COMPANYDMZ issuer= /CN=COMPANYDMZ
I am not sure what the issue actually is. I have tried creating a new certificate request on the DMZ and then requesting a cert from the root ca so it would have a verified "chain" back to the CA but I still get the same error. I have changed the edge transport cert back to the default self signed cert that came when I installed it.
The exchange server itself has a third party certificate (company.co with SANs mail.company.co and autodiscover.company.co)
Can anyone possibly shed some light on what needs to be done?